Re: [PATCH 1/3][CONNTRACK] Introduce flag facilities to take over TCP connections

[Pablo Neira Ayuso <pablo@netfilter.org>]

Patrick McHardy wrote:
> Pablo Neira Ayuso wrote:
>> Patrick McHardy wrote:
>>
>>>> +	NFA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_ORIGINAL, sizeof(u_int8_t),
>>>> +		&ct->proto.tcp.seen[0].flags);
>>>> +	
>>>> +	NFA_PUT(skb, CTA_PROTOINFO_TCP_FLAGS_REPLY, sizeof(u_int8_t),
>>>> +		&ct->proto.tcp.seen[1].flags);
>>> The attributes should contain the same data type in both directions,
>>> the receive side expects a structure.
>>
>> how could the mask field make sense for the dumping?
> 
> It doesn't really make sense, but an attribute encapsulates
> one type of information and should always use the same
> representation. If this is sent over the wire to another
> host for example it would need to distinguish whether it
> contains the kernel->user representation or the user->kernel
> representation, which IMO is bad design.

Totally right, I'll rework this minor issue and get back to you.

-- 
The dawn of the fourth age of Linux firewalling is coming; a time of
great struggle and heroic deeds -- J.Kadlecsik got inspired by J.Morris